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DTI Accomplishments Supporting NCTC Goal 1: Leadership 

[S//NF] One Millionth TifDE Person Record; On 28 June 2013, the Terrorist Identities 
Data mart Environment (TIDE) passed a milestone of one million persons in TIDE, While 
N ETC's Directorate of Terrorist Identities (DTI) seeks to create only as many person 
records as are necessary for our nation's counterterrorism mission, this number is a 
testament to DTI's hard work and dedication over the past 2,5 years. Since DTI stuod up as 
an independeiit NCTC Directorate in December 2010, analysts have created more than 
430,000 terrorism- related person records and deleted 50,000 subjects whose nexus to 
terrorism was refuted or did not meet current watchlisling criteria. In addition, DTI has 
added over 730,000 biometric files to TIDE, On a daily basis, DTI analysts process more 
than 250 nomination cables and 200 encounter reports, visa applications and other data 
sources to support the U.S. Government's (IJSG) screening and terrorism analysis missions. 

(U//FOUO) Processing Nominations into TIDE: 



(S//NF) Kingfisher Expanding its Role; NCTC deployed the Kingfisher Expansion (KFE) 
visa support program on 15 June, 2013. KFE is a recently developed terrorist screening tool 
that correlates large datasets to help enhance existing terrorist identity information to 
support USG watchlisting/ screening missions. The KFE tool reviews DoS visa applications 
for connections to terrorism information and then uses the knowledge to enhance existing 
records maintained in TIDE. KFE performs a near real-time check against TIDE for all 
worldwide visa applicants prior to Department of State (DoS) approval, KFE is processing 
nearly 40,000 applicants each day, has processed over 4,6 million visas since its "go-live" 
date in June, and is projected to save the DoS over $50 million in security check fees. 



in 2Q13 
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SECRET// NO FORK 



Page 2 



SECRET/ /NO TORN 



(5//NF) DTI Support to Boston Bombing Investigation: In the wake of the Boston 
Marathon bombings, NCTC/DTl was deeply involved with all facets of the response, 
immediately following the incident, DTI contributed to FBI deep dives, identified potential 
suspects, and delivered information to national leadership as well as coordinated with the 
FBI on biometric holdings in TIDE* Longer-term, DTI responded to the US Senate and House 
Congressional Intelligence Oversight Committees and prepared formal testimony that 
aided the Director of NCTC, Principal Deputy Direction of NCTC, and Director of DTI for 
appearances on Capitol Hill. From this incident, DTI identified several lessons learned that 
were incorporated into the Directorate's policies and processes, 

(U//FOUG) Terrorist Identities DatamarL Environment (TIDE) Classification Guide 
(CG); Working with community partners, DTI finalized the first copy of the TIDE CG. This 
guide will serve as the official document for general classification guidance and 
classification policy controls and procedures for the dissemination and use of TIDE 
information, ensuring it will be adequately protected. 

(Sf /NF) Biometric Enhancement Scrub for Watchlisted US Persons: Through a 
comprehensive review of TIDE holdings relevant to the Boston Marathon bombing, NCTC 
recognized the need to ensure that watchlisted US persons included available facial images 
and fingerprints. This project includes record by record research of each person in relevant 
Department or Slate and 1C databases, as well as bulk data requests for information. The 
bulk requests were sent to our partners at FBI and DHS for any related biometric data, 
including driver's license images. When the project started there were B14US Persons 
without any biometric information in TIDE, equaling to less than 20% of the total 
watchlisted US persons. Upon completion of this project, NCTC has added 370 facial images 
and 249 fingerprints for 163 US persons. 

(3//NF) Mali and Chechnya/Dagestan Enhancement Scrubs: in FY13, DTI completed a 
targeted scrub of TIDE subjects with connections to Mall or terrorist groups known to 
operate in Mali based on the recent conflict and ongoing threaL to US and Western interests 
there. Separately, TIDE subjects with a nexus to Chechnya or Dagestan were reviewed in 
the. wake of the Boston Marathon bombing, 

• DTI analysts reviewed more than 1,700 TIDE records on subjects associated with 
these threats, resulting in some 11,5(10 enhancements to over 600 TfDE records. 

* The scrub also resulted in watchlist status upgrades for 55 TIDE subjects. 

(S//NF) Biometric Analysis Reports: The Biometric Analysis 
Branch (BAB) continues to provide support to a broad customer 
base through their unique skill of facial identification support. In 
2013, BAB produced 291 Biometric Analysis Reports which 
provide facial identification support to customers from NCTC, DOD 
(AFOSI, SOCOM, PACOM], DOS, CIA, NMEC, DHS (CBP, NTC], FBI 
(TSC'LDIA, NGAand NYPD. 

' 2012 2013 
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(U//FOUO] DTI Threat Team (DTT/MTT): 



DTI Threat Team (DTT) Increases 
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(S//NF) Reduction of TIDE Enhancement Backlog: This year, automation, policy 
modifications, and resource realignments helped reduce a historic backlog of Department 
of State Consular Consolidated Database [CCD) records consisting of visa information on 
KSTs that are already in TrDE and/or watchlisted in the TSDB. DTI had experienced a 
historical backlog that numbered in excess of 153,000 records. This number was reduced 
by 88% in FY13 to around 18,000 and that should be completely eliminated by Q1 2014. 
This reduction will allow Tor all newly identified KST TIDE records to be enhanced with 
CCD information within 48 hours of nomi nation. 

[S//NF] NCTC Meets HSPD-24 Requirements for Biometric Export: In March 2013, in 
accordance with HSPD-24/N5FD-59, the full implementation of the biometric export 
occurred. This culminates a five year effort, which included significant changes such as 
moving from TIDE1 to T1DE2, in order to provide storing and matching capabilities for 
facial images, fingerprints and iris scans. As part of this effort, NCTC delivered biometric 
data for more than 127,000 known or suspected terrorists [KSTs) to the Terrorist 
Screening Center to date. Due to the hard work by NCTC, writ large, these KSTs will have 
their biometric data properly placed into the biometric screening systems. This means 
when one of these known or suspected terrorists attempts to enter the United States either 
by applying for a visa or through a DHS point of entry screening, regardless of falsified 
documentation, the subject will likely be denied entiy, 

[S//NF] Growth for Non-Traditional Biometric Data: DTI has continued to enhance 
several "non -traditional" biometric data fields in TIDE, for FY13 TIDE has shown the 
following growth: Handwriting [32%); Signatures (52%); Scars/ marks /tattoos [70%); 
DNA strands (90%). Beginning collection on this data helps to ensure that when the 
biometric and forensic community is ready to actively screen this data, that NCTC will be 
readily a hie to provide the appropriate data on all known or suspected terrorists. 
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(S//NF) TIDE Records Enhanced with Biometrics data: 



Increased TIDE Biometric Holdings in 2013 
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(S//NF) Biometric Data Sources: DTI has seen a large increase of biometric data in 2013, 
both actively received from the nominating partners as well as proactively sought by the 
identity Intelligence Group. The top five agency contributors of data are as follows: 
Department of Defense [60%), DHS (13%), CIA (12%), FBI (9%) and State Department 
(5%). 

(S//NF) FBI Platinum ProjectSupport; Since 17 June 2013, DTI reviewed 1,678 TIDE 
nomination cables in support of the FBI's Platinum PrujecL ThePlaLinum Project was 
initiated by theTSC Nominations and Data Integrity Unit (NDIU) as a proactive means to 
identify FBI subjects of interest and US Persons who are nominated by Other Government 
Agencies (OGA) and are currently watchlisted in the TSDB. DTI conducted research in the 
FBTs Sentinel and Guardian databases to determine if the subjects identified in nomination 
cable traffic had an open or closed case or Guardian lead. This year, 1,142 Platinum leads 
were submitted to the FBI resulting in 42 new threat assessments, 5 preliminary 
investigations, one full field investigation, and four individuals being removed from the 
watchlist. 



(U//FOU0) Quality Assurance Requests! More than 1,000 de- merge requests were 
reviewed to ensure that records which had incorrectly identified multiple subjects as one 
person, were appropriately divided into separate records. Conversely, over 6,500 person 
mer ges, nearly 13,000 location merges, and 11,200 merges of other entities was done, this 
removed duplicate data from TIDE and ensured the accuracy of these records, 
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[IJ//FOTJO] TSC Requested TIDE Quality Assurance Reviews; 
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(U//FOUQJ TIDE Quality Assurance Reviews; The Quality Assurance Branch [QAB) 
reviewed 6,500 legacy records as part of a proactive scrub of 60,000 single-source TIDE 
records where no update has occurred since January 2011. QAHE reviewed records for 
2,550 KSTs from visa waiver countries and 3,800 of the qualifying records that were 
created between 1994 and 1996. This work resulted in: 61 individuals removed from 
watchlisting [including 30 deletions from TIDE]; three upgrades to TSA NOFLY; nine 
records merged with other entries; and 39 records with added biographic data. Additional 
enhancement work by the Identity Enhancement Team oil 500 of the visa waiver records 
resulted in 10 watchlisting upgrades, and the addition of 47 first- time dates of birth, and 14 
biometric files, 

(U//FQU0) 2013 Analytic Products: 

T errorism Identities Analysis Production 
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(S//NF) TIDE Quality Assurance Special Projects: 
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(Sf/NF) Enhancements Using CBP Data: 
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DTI Accomplishments supporting NCTC Goal 2: Partnership 



Internal to NCTC: 
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(S//NF) Threat Case Management anti Syrian Foreign Fighters: In 2013, DTI created 
and maintains 12 threat cases, which link all known actors- and their biographic and 
biometric identifiers-to a particular threat stream, providing analysts across the 
community one centralized resource. The cases were collaborative efforts with NCTC/DI 
and DSOP, DHS/J&A, CBP, and TSA 
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The Syria Pc reign Fighter Threat Case In TIDE provides the IC's common record for the 
activities of more than 3,200 KSTs associated with Syrian This case contains a total of 3 f 258 
individuals, to include 715 Europeans and Canadians and 41 US Persons, 37 of which are 
watchlisted in TSDB, 

External to NCTC: 

(S//NF) Chicago Marathon supported by DTI IIG and AEG TIDE Analysts alongside 
FBI: Based on the lessons learned from the Boston Marathon, DTI analysts in AEG and i!G 
worked alongside the FBI and the NCTC Midwestern Representative to suppose the Chicago 
Marathon, Analysts performed deep dives in Tide for biometrics, and located all of the 
entries that had no photo or fingerprints. Analysts also pulled all of the records in TIDE of 
people who held a drivers license in Illinois, Indiana and Wisconsin. Doing their due 
diligence with those TIDE lists, analysts ensured no one warranted further scrutiny by the 
FBI before the race. 

(S//NF) Biometric Support to NCDC: in FY13, DTI began assisting the National 
Collaboration Development Center (NCDC) with their Targeting Collaboration Course 
(TCC). The TCC is an interactive scenario- based training in which students learn to enhance 
existing source identification skills by providing tactical analysis intended to spur an 
operational action against a human target. 

[U//FOUOJ Driver s License Initiative: To fulfill the biometric enhancement mission 
within DTl's Identity Intelligence Group (IIG), the Biometric Analysis Branch (BAB) began 
an outreach/partncrship effort with the larger law enforcement community to collect facial 
images associated with driver's license data. With support from FBI partners and NCTC's 
Domestic Representatives, this enhancement mission took on significant growth in EY13. 
BAB now coordinates directly with the following states; Arizona, Texas, New York, 
Maryland, Delaware, Washington DC, Florida, California, Virginia, Oregon, Massachusetts, 
Nevada, Georgia, Colorado, Washington, and Rhode Island. This effort has resulted in 2,400 
Driver's License facial images added to TIDE in FY13. 

(S//NF) international Travel Data (1TD): DTI identified information gaps between TIDE 
and CIA's i I D and worked with CIA to add the missing data to TIDE from clandestinely 
collected travel data. This effort resulted in the inclusion of 892 fingerprint files and an 
additional 1268 data points added to TIDE. DTI used the data to enhance a total of H9Z 
identities in TIDE. 

[IJ// FOLIO) CMQ Outreach Initiative: To increase the biometric and biographic 
information on KSTs detained worldwide, DTI began working with the Cl As Collection 
Management Officers. As a result, over 150 requests have been sent to the field and nine 
new national HU Ml NT collection requirements have bcon written. Additionally, DTI is now 
sending collection requirements directly to the field using the CJ A Information Needs 
Management database (CINEMA). This will allow DTI to obtain information that lias not 
been collected and use it to enhance 1' IDE. 
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(LF//FOUO] DTI Outreach Efforts- JTT officers, together with representatives from the 
Terrorist Screening Cetiier s T5G training team, traveled to FBI Miami and FBI Los Angles, 
visiting Field C Bices srd fusion centers to educate analysts and agenLs about DTI, TSC, 

TIDE, and the watchiistmg business process to aid in their role of reviewing case 
information and Guardian iead5 : ana participation in the Encounter process. 2013 is the 
first year that DTI and TSC have partnered to provide outreach and training outside of the 
metro DC area. 

(U//FOUQ] Training Expanded for External Partners: DTI officers traveled to Glynco, GA to 
provide a brief to approximately 50 Counterterrorism Division instructors and leads at the 
Federal Law Enforcement Training Center fFLETC). The goal was to establish a partnership 
with FEKTC and to educate the instructors about DTI, TIDE, and the watchlisting business 
process, In the VVMA r DT! has also expanded its training offerings, holding a quarterly 
training session in the LX auditorium for ail IC members. In FY13, DTI provided advanced 
TIDE training to 95 analysts representing nine partner agencies (TSC, TSA, MG A, DoS, DH5. 
FBI, CFB, US Army Special Forces, and Bureau of Diplomatic Security]. 

(S//NF] Biometric Training Program Offered to Additional Partners: DTI now offers a 
half-day Biomet rlcs Training Program once a month that is open to all fC partners holding e 
TS/SCI clearance. The course provides a basic familiarization of classified and unclassified 
biometrics repositories: an overview of the watchiistmg process as it pertains to biometrics 
and identity intelligence; and an introduction to targeted biometrics research atNCTC. 

(U//F0UG] DTI, TIDE and WatchlLsting Review: This review brought together 
cxpcricnced members of the watch listing community to take a genuine look at how the 
community is doing. Participants were asked to put the views of their home agencies aside 
and take an objective look at the watchlisting process, TIDE, and DTl J s support of TIDE and 
the watchlisting process. The exercise culminated in ail assessment paper providing five 
key findings, seven recommendations for Improvements, and acknowledging those areas 
that excel. 

(3//NF] CIA -Hydra ; DTI has partnered with CIA to enhance select populations In TIDE 
with clandestinely acquired foreign government information from CIA's Hydra program. In 
this multi-phased project, DTI provides CIA with TIDE data and it is correlated with Hydra 
information to uncover additional Terrorism Information [Ti] on KSTs that is then used to 
conduct Quality Assurance reviews on existingTIDE records. As proof of concept, DTI 
provided CIA a list of 555 Pakistan based subjects identified as KSTs in TIDE, The Hydra 
program vetted these names against Pakistani Passports and provided TIDE record 
enhancement Information (biographic and biometric identifiers] back to DTI. The next step 
will be to provide CIA with a list of TIDE subjects with National ID Numbers [-1,700] for 
vetting on dates of birth. Future initiatives will include additional targeted countries, as 
well as a targeted effort to locate FirsL-Lime DDHs for subjects with Passports and Nations! 

ID Numbers. 

(U/ /FOUO] Wa Lchlisting Guidance Review IPC: In 2013 the Watchiistmg Guidance 
Review 1PC completed a major, muitTyear effort to review and update the July 2010 
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Watchlisting Guidance. DTI participated in multiple detailed reviews providing comments 
and inputs and provided suggestions tor improving the Guidance. The effort culminated in 
an approval by the Deputies Committee (DC) in March 2013, 

[U//FOUQ1 INTERPOL Information-Sharing Agreement INTERPOL Red Notices contain 
derogatory information, biographies, and biometrics which can serve to both create new 
TIDE records and enhance currently existing records. Through coordinated efforts, 
processes were developed whereby the FBi's National JTTF served to nominate subjects of 
Red Notices to TIDE for watchlisting and EAG is enhancing existing TIDE records with 
active Reel Notices. 

[S//NF] Foreign Collected Terrorist Biometrics: In 201 2, the Biometric Analysis Branch 
partnered with FBI's Global Initiatives Unit to nominate biometric data eapLured on 
terrorists from foreign partners Into TIDE, This process has continued to evolve and grow. 
In FYI3, this process has enhanced over 1,000 terrorist records enabling effective 
biometric screening, 

[S//NF] National Media Exploitation Center (NMEC): The Biometric Analysis Branch 
continued to support a DTI liaison within NMEC which proved beneficial to both 
organizations, The arrangement enables NCTC to obtain additional data fusion points by 
accessingand exploiting NMEC data holdings and, in return, DTI provides NMEC with a 
classified biometric search capability against TIDE through automated and manual facial 
identification support To date BAB has enhanced 33 TIDE records and provided over 7,000 
search results to NMEC. From this effort, in December 2012, the Encounter Analysis Branch 
established a CBP Encounter Package foreign document translation process with the 
National Media Exploitation Center and has completed 119 requests for translation and 
addendums to TIDE. 



DTI Accomplishments supporting NCTC Goal 3: Workforce 

[U//F0UG) DTI Internal Training: Standard DTI Internal Training: In 2013, DTI provided 
training for a total of 124 new hires, a 100% increase over 2012. Over 80 of these new 
hires were trained during a two month period during the contract transition, an 800% 
increase over the previous two months. The training team was able to make considerable 
adjustments to accommodate tills extremely high influx of personnel. In addition, DTI has 
developed and implemented a refresher course that provides incumbent analysts the 
opportunity to reinforce the fundamentals of II DE production. The course highlights 
general policy and process updates of which analysts may not be aware given the different 
focus areas of the various branches within DTL Finally, DTI developed a familiarization 
course for those in DTI who are interested in gaining a perspective on DTI operations. 
Topics include overviews o l external IC policies, watchlisting, Kingfisher, TIDE, Biometrics, 
and DTI overview. A pilot and a full session ran In 2013, 

[U//F0U0) Mock CAB: DTFs Professional Development Working Group sponsored mock 
Career Advisory Boards [CAEs], which were designed to provide employees insight to the 
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documentation and process involved in CAB decisions. Volunteer CAD panelists reviewed 
fictitious persons' PERs and bios and drafted Employee Assessment forms for the 
"employee" they represented on the panel, ADD/DTI and DTI/COS acted as panel chairs to 
guide the process and facilitated an open discussion after the panels completed their 
employee evaluations, Participants gleaned insight into the importance and complexities of 
documentation and the process, 

(U//F0U0) Expansion of Identity Intelligence (12) Training Module: The training is 
taught once a month and has been well received across the community. This external 
course consists of a half day version of the DTT's Biometric Training Program. In addition, 
as an effort to ensure that every analyst within DTJ has a basic understanding of biometric 
data and workflows, a shortened version of the training was incorporated into the MIO 
Training and Outreach Tea in portfolio. The additional DTI course consists of a one hour 
block which has been incorporated into both the DTJ New Hire Training as well as the DTI 
Manager Training as of June 2013. 



DTI Accomplishments supporting NCTC Goal 4: Process 



(U//F0UQ) DTJ Policy Response Team; DTI mi piemen ted a key process for addressing, 
coordinating, and responding :z critics' res actions such as the responses to the Boston 
Marathon bombing, Congressional questions for the record. White House requests for 
information and policy cookTze: onDNl takings, and NCTC directed actio ns. The team 
ensures taskings are researched before : = rgsect out across the Directorate, coordinated 
appropriately within DTI. arc t hat rezoon?— are consolidated and accurate, Since January 
the team has successfully rss-archec =n z resrar.ded to over 110 actions, 

(U//FOUO) Governance Structure: DTI established an internal governance structure tq 
encourage the expSora?:: r : f re-. ' d :zs p- : r.z.zitizn of activities, and enable informed 
decision making. The two re . r~z _ :s tre Irz ,.z Chiefs Forum and the Futures Forum 
provide a process for dess s - - rk Ez * 3 t: be - etteb and pushed up for decision. 

(U//FOUO) Applied Correlation to TIDE (ACT); The ACT initiative enables DTI analysts 
to correlate TIDE dataagz - : „5 Iz:e ‘zezzz Community and Law Enforcement 
databases. Using the ns ^ z :z Tincrrm TIDE .analysts are able to quickly conduct 

a search across several aatzz ls-=i :: zz:=r - ' . r= - there is any existing data that can be used 
to enhance a TIDE re-zzr: T - s T-zzii-C r ? rurren Ty being piloted within the QA and 
IIG teams to determz z ’z _:ez 

(U //FOLIO) Facilitation of Strategic Plamnsg Across DTE Starting In June 2013, DTI 
began executing & rrz: ■■ z z ; z zzss :: T ’-zzrz-^5 in tse current DTI strategic plan 
(published in jan 1Z = z 5: - TTl-assigned Initiatives in the NCTC strategic 

plan [published Feb Z3 Er^z— : :;z zzzztez : rises provide a venue to focus 
Directorate activities Tc. :z.: z: _ z:zrrr z: :zz 
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(U//FOUO) Development of Metrics to Minimize Individual Requirements lo Track 
Work Completion: DTI developed a monthly TIDE -based metrics template in May 2013 
and began [retroactively] tracking several datasets effective 1 Jan 2013. Information 
collected includes data on nominations, nomination backlog, special projects/ bulk ingest, 
new entities created, encounters, and QA audits, 



DTI Accomplishments supporting NCTC Goal 5: Technology 

[IJ//I'0U0] Standard Nomination Tool: DTI, along with Walchlisling Community 
partners, upgraded the standard nomination tool used to send data for entry into TIDE, 
Significant improvements were made to the user interface to streamline the process of 
submitting data and the Inclusion of the TIDE Restricted capability provided nominating 
agencies the ability to ensure thaidaLa too sensitive for export to unclassified systems 
could be appropriately marked and handled by TIDE. This allows nominating agencies to 
provide more data than previously disseminated as appropriate controls are now jn place 
to ensure the sensitivity of the data is accounted for. 

(S) Bulk Ingest capability: DTI developed an inLernal self-service program to ingest large 
datasets for automated exploitation and enhancementofTIDE records, The self-service 
capability allows DTI to quickly ingest large datasets into TIDE in a flexible environment 
where those providing the technical support are fully trained on DTI's policies and work 
closely with those who will process the data, The result is fewer policy errors and the 
ability to quickly make modifications and set priorities based on DTI's needs. The 
program s efficiency has enabled DTI to ingest multiple datasets in the time that the 
previous process would have taken to prioritize the dataseLs, 

[U//POUO] Database Development IlG p s Data Exploitation Team developed a database 
which has created multiple efficiencies for internal processes. The database allows for 
automated tracking, metrics reporting, increased accuracy in de-duplication, and allows for 
tracking and identification of KSTs Tor further research, The database also allows for 
tracking of FiSA classified cables. This database has saved at least 10 hours of work per 
week and has streamlined processes for RFIs, metrics, and identity management. Based on 
this success, this database has been duplicated for other internal DTI sections. 

(S//NFJ EFT of CBP Packages to TIDE: After 2-plus years of development, the early 
February 2013 approval of the Interconnection Security Agreement between CBP and NCTC 
resulted in the successful electronic file transfer of CBP Encounter Packages to TIDE. 
Previously, the Encounter Packages were retrieved from CBP via a Compact Disc. Since the 
7 March 2013 start up, mure than 5,378 Encounter Packages have been received and 
processed into TIDE by EAB. 
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